How to specify user group attribute for access control

Question

I have sycned up AD users and groups to IAM identity center already, and i'd like to control S3 bucket access based on User group. For example, there are two groups bigdata and operation, how can i specify the key-value on IAM Identity center attribute access control Enter image description here

I tried to hard code the value like Department=bigdata. But it's required to use dynamic expression since different user belongs to different groups. I searched IAM Identity Center official doc, but i can't find who to describe group name with supported placeholder

Answer

Hi Neal,
The way ABAC (Attribute-based access control) is based on Tags, check this [1](https://docs.aws.amazon.com/singlesignon/latest/userguide/abac-checklist.html) and [2](https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging-and-policies.html) , this is an example of s3 policy:
***
 `{
  "Version": "2012-10-17",
  "Statement": [
  {
    "Principal": {
      "AWS": [
        "arn:aws:iam::111122223333:role/JohnDoe"
      ]
    },
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:GetObjectVersion"],
    "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
    "Condition": {
      "StringEquals": 
        {"s3:ExistingObjectTag/Department": "bigdata"}
    }
  }
  ]
}`
***

How to specify user group attribute for access control

Relevant content